Attacks overnight into Monday, November 2, 2026; French wave October 11 to 12, 2026; CERT-FR alert CERTFR-2026-ALE-012
Attackers Warmed the Freezers: A Second Refrigeration Wave Hits Supermarkets Across Europe
Attackers remotely tampered with refrigeration controllers at more than 100 supermarkets and food shops across Europe overnight into Monday, November 2, switching units into defrost mode or raising set points and forcing stores to discard chilled and frozen food. Belgium was hit hardest: Delhaize reported several dozen stores, around 40 by its count to VRT NWS, with temperatures in some units climbing to 15 degrees Celsius and four stores affected in Luxembourg; Carrefour Belgium confirmed about 15 of its 700 stores, Intermarche Belgium 10 to 15, Colruyt said about 5 independently run Spar shops, and one IKEA store in Mons was hit. In Sweden, a Sjobo ICA store found its freezers set to plus 50 degrees Celsius, Coop confirmed a cyber incident at 7 of its more than 800 stores, and an Axfood delivery warehouse was affected through an outside refrigeration supplier. Musgrave pulled food from sale at 13 SuperValu stores in Ireland and later said the incident was resolved. A Danfoss spokesperson said at least 17 Dutch businesses were attacked, that those systems were not on a secured network, and that they still used a default password. In Estonia, one Selver store was caught within about 10 minutes with no goods lost. Reporting by The Hacker News, drawing on AFP, adds 7 Intermarche stores in Portugal and at least 4 Coop stores in Sicily. The wave follows the October 11 to 12 attack on roughly 700 French supermarkets, and France's CERT-FR alert CERTFR-2026-ALE-012 names the exposed equipment classes: Danfoss AK-SM and AK-SC controllers and Copeland and Dixell XWEB supervisors. Belgium's federal prosecutor has opened an investigation. No group had claimed responsibility by Monday night, no ransom demand has been reported, and no authority has publicly tied the attacks to a specific CVE.
Executives
This is operational technology risk with a grocery bill attached: one Proxy Delhaize operator estimated losses at EUR 60,000 for a single store, and the same controller class was warned about after France three weeks ago, yet about 10 percent of one installer's Belgian base was still unsecured when the second wave landed. The lesson is not about supermarkets. Any remotely managed controller, in a store, a warehouse, a clinic or a plant, that stays reachable from the internet with a default password is an incident waiting for its night. Ask which of your sites run internet-reachable controllers and who owns securing them, you or a contractor.
CIO / CISO
Work the CERT-FR and Belgian CCB guidance as a checklist: no controller reachable from the public internet, access only through a VPN or protected network, firmware current, default passwords changed, Danfoss units set to Strict security mode, and defrost schedules and set points reviewed. Treat contractor remote access as part of your own attack surface, with named accounts and an inventory of which sites each contractor can reach. End-of-life controllers that no longer receive fixes need isolation or replacement, because a factory reset leaves them open to the same attack.
Engineers
Sweep for exposure the way the attackers did: scan your address space for refrigeration controller interfaces, check each unit's defrost schedule and temperature set points against the intended configuration, and confirm overnight temperature alarms reach a person who can act. In the Dutch cases the systems were simply not on a secured network and still used the default password, so verify the basics on every unit rather than sampling a few.
Everyone (non-IT)
If a store near you had empty freezers this week, this is why: someone reached the fridges over the internet and told them to warm up. There is no sign of risk to shoppers from the attack itself, and stores discarded food as a precaution where temperatures rose. The broader habit worth copying at home is the same one the stores missed: change default passwords on anything connected, and keep remote access off unless you actually use it.